Lock the Back Door: Why Good Cyber Hygiene Still Stops Most Attacks

AUTHOR: 313SEC INTELLIGENCE | DATE: DEC 02, 2025

There is a persistent myth in cybersecurity that modern attacks are impossibly sophisticated. That threat actors operate with godlike tools and zero-day sorcery that no small or mid-sized business could hope to defend against.

The reality is duller, and far more dangerous. Most breaches do not begin with brilliance. They begin with neglect.

Strip away the marketing jargon and it becomes clear that the majority of attacks are not clever. They are opportunistic. Good cyber hygiene still blocks the vast majority of threats. Not all. But enough to change the odds heavily in your favour.

The Boring Defences That Keep Working

Cyber hygiene is not exciting. That is why it works.

• 1. Patch Like It Matters (Because It Does) Unpatched systems are gravity wells for attackers. Vulnerabilities published today are often exploited within days. Threat actors subscribe to feeds and automate everything else. If it touches the internet, it needs a defined, enforced patching window. Delaying patches to "avoid disruption" usually ends with disruption of a much louder kind.
• 2. Multi-Factor Authentication Everywhere Passwords are relics. MFA is the thin membrane separating a credential phishing email from a full environment takeover. Most compromise chains collapse immediately when MFA is enforced correctly. Not "optional MFA". Not "MFA for admins only". Real enforcement.
• 3. Least Privilege Is a Survival Strategy Most users do not need admin rights. Attackers love flat networks and over-permissioned environments because they turn one mistake into total compromise. Reduce privileges. Separate admin accounts. Kill old access. Every locked door reduces the blast radius.
• 4. Email Filtering and Awareness Email remains the most reliable delivery mechanism for initial access. Filtering stops a high percentage of noise. Awareness training stops the rest from detonating. The goal is not perfection; the goal is reducing the number of clicks that matter.

The Less Discussed Controls

This is where many organisations fall down. Not because they lack tools, but because they ignore the quieter indicators.

• 5. Disable Legacy Authentication It is astonishing how often legacy auth is left enabled "for compatibility". Legacy auth is a time machine attackers love. No MFA, minimal logging, easy spraying. If it is not explicitly required, turn it off.
• 6. Kill Dormant Accounts Ruthlessly Old employees. Contractors. Service users no one remembers creating. Attackers do not need to break in if the door was never closed. Dormant account auditing is dull work, but it is one of the cheapest wins available.
• 7. Log What Matters, Not Everything Logging is not about collecting data; it is about answering questions under pressure. Who logged in? From where? Most breaches are visible in logs long before they become incidents. They are simply not seen.
• 8. Assume Credentials Will Leak Credentials will leak. Phishing will succeed. Design defensively using conditional access, location rules, and device compliance. You are not preventing mistakes; you are containing them.

Unusual Practices That Pay Off Quietly

These controls rarely appear in basic checklists, but they consistently reduce real-world impact.

• 9. Canary Accounts and Honeytokens Create fake accounts. Fake mailboxes. Fake API keys. Anything touching them is malicious by definition. They do not stop attacks; they tell you immediately that one is happening. That time advantage is often the difference between containment and catastrophe.
• 10. Time-Delay Admin Privileges Permanent admin access is a gift to attackers. Just-in-time access turns lateral movement into a race against the clock. Most attackers lose that race.
• 11. Monitor Outbound Traffic Most organisations obsess over what comes in and ignore what leaves. Command-and-control traffic and data exfiltration are often louder than the initial intrusion. Egress visibility is a neglected discipline.
• 12. Reduce Digital Noise Every unused application and legacy integration is another attack surface. Security is not only about adding controls. It is about subtraction. Remove what you no longer need. Silence is safer.

The Uncomfortable Truth

Cybersecurity has been mythologised into something inaccessible. In practice, organisations fail because the basics were never enforced. Good cyber hygiene does not make you invisible. It makes you harder than the alternatives.

Attackers, like everything else driven by economics, go where resistance is lowest.

Lock the back door. Most never make it to the front.